Network accounting involves the collection of various types of information pertaining to the data communications over a network, and sending and receiving information over a network. Examples of such information may include, but is not limited to a communication session's source, destination, user name, duration, time, date, type of server, volume of data transferred, etc. Armed with such accounting information, various services may be provided that require network usage metering of some sort.
Networks are often subject to various attacks wherein a perpetrator attempts to infiltrate a system. During a denial of service (Dos) attack, a network failure is likely to occur as a result of data being transmitted over the network. Accompanying such attacks is a surge in the amount of accounting information that is generated by various devices. Such accounting information is collected and sent to the back-end systems such as Operation and Business Support Systems (OSS/BSS). Overwhelmed by the overload situation, back-end systems may fail leading to the loss of valuable network accounting information and loss of service revenue ultimately.
For instance, if a computer attempts an attack, i.e. syn or fin, on a network, it will scan a plurality of ports. There are generally 65,536 ports to scan for a network device, and all this takes place over a very short period of time, typically several seconds. In general, the amount of network traffic generated by these attacks is negligible (as the data associated with attacks is generally of control and management nature that is short and can often be encapsulated in a small data packet), but the amount of accounting data created is large as accounting data is generated for events happening in the network. For instance, it would create 65,536 log entries in a firewall log, or up to 131,072 NetFlow flows, for each host that it attempts to attack. If a ping attack is used, then a plurality of Internet Protocol (IP) addresses is scanned in a similar fashion.
By way of background, a port is a “logical connection end-point” that associates a communication channel with entities running on a server or a client. Typical entities may be a program or an application executed on the client or server. A communication channel may be established as TCP connections using the Internet Protocol. Higher-layer applications that use TCP/IP such as the Web protocol, HTTP, have ports with pre-assigned numbers. These are known as “well-known ports” that have been assigned by the Internet Assigned Numbers Authority (IANA). Other application processes are given port numbers dynamically for each connection. When a service (server program) initially is started, it is said to bind to its designated port number. As any client program wants to use that server, it also must request to bind to the designated port number. Port numbers are from 0 to 65535. Ports 0 to 1023 are reserved for use by certain privileged services. For the HTTP service, port 80 is defined as a default and it does not have to be specified in the Uniform Resource Locator (URL).
A port scan is a series of messages sent by someone attempting to break into a computer to learn which computer network services, each associated with a “well-known” port number, the computer provides. Port scanning, a favorite approach of computer hackers, gives the assailant an idea where to probe for network weaknesses. Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed for weakness.
Exemplary Types of Port Scans Include:
    Vanilla—An attempt to connect to all ports (there are 65,536)    Strobe—An attempt to connect to only selected ports (typically, under 20)    Stealth scan—Several techniques for scanning that attempt to prevent the request for connection being logged    FTP Bounce Scan—Attempts that are directed through an FTP server to disguise the cracker's location    Fragmented Packets—Scans by sending packet fragments that can get through simple packet filters in a firewall    UDP—Scans for open UDP ports    Sweep—Scans the same port on a number of computers
Unwanted accounting information surges can also occur as a result of situations other than network attacks. For example, information may be collected from unreliable sources. Further, a storage capacity of a system may be inadequate. In still other situations, some information may be deemed pertinent, while other data may be deemed expendable.
There is therefore a need for a technique of identifying attacks and/or other network conditions; and more importantly, preventing the propagation of large amounts of accounting information to back-end systems which may in turn result in undesired failure in the network accounting process.